fix(delivery): address review feedback on idempotency, crash recovery, and security

- Idempotency: verify RequestedBy matches caller to prevent cross-user key reuse
- Crash recovery: persist ExecutionJob (launching) before AWX Launch, update to running after
- Terminal state: finish ExecutionJob on success/cancel/failure; failTask accepts canceling
- Reservation TTL: filter expired reservations in quota aggregation
- Ansible heredoc: use <<'EOF' to prevent shell expansion of secrets; escape single quotes
- Validation: align Go resource ranges with playbook (mem 1024-4096, storage 10-100)
- Version whitelist: only allow 8.0, pass mysql_version to AWX extra_vars; playbook selects package via map

Relates-to: #97

server/internal/service/delivery_test.go

@@ -7,10 +7,19 @@ func TestValidateDeliveryInput(t *testing.T) {
 	if err := validateDeliveryInput(valid); err != nil {
 		t.Fatalf("valid input rejected: %v", err)
 	}
+	withVersion := valid
+	withVersion.MySQLVersion = "8.0"
+	if err := validateDeliveryInput(withVersion); err != nil {
+		t.Fatalf("valid input with version 8.0 rejected: %v", err)
+	}
 	for name, input := range map[string]MySQLDeliveryInput{
-		"uppercase namespace": valid,
-		"bad instance":        valid,
-		"too little memory":   valid,
+		"uppercase namespace":  valid,
+		"bad instance":         valid,
+		"too little memory":    valid,
+		"too much memory":      valid,
+		"too little storage":   valid,
+		"too much storage":     valid,
+		"unsupported version":  valid,
 	} {
 		switch name {
 		case "uppercase namespace":
@@ -18,7 +27,15 @@ func TestValidateDeliveryInput(t *testing.T) {
 		case "bad instance":
 			input.InstanceName = "mysql_01"
 		case "too little memory":
-			input.MemoryMi = 128
+			input.MemoryMi = 512
+		case "too much memory":
+			input.MemoryMi = 8192
+		case "too little storage":
+			input.StorageGi = 5
+		case "too much storage":
+			input.StorageGi = 200
+		case "unsupported version":
+			input.MySQLVersion = "5.7"
 		}
 		if err := validateDeliveryInput(input); err == nil {
 			t.Errorf("%s was accepted", name)